We comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). The Privacy Act regulates how we collect, use, disclose and store personal information including sensitive information, and provides you with a right of access to and correction of records containing your personal information.
We also hold personal information in accordance with the Archives Act 1983 (Cth).
Questacon is a division of the Department of Industry, Science and Resources and follows department policies. Further information about how Questacon handles personal information is available on the Department of Industry, Science and Resources website.
Our Privacy Policy & Privacy Collection Statement describes how we protect and manage personal information, including sensitive information, consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It explains:
• how and why we may collect your personal information
• how it is used
• when and how we might share it with others
• how you can access and seek to correct your personal information
• how to make a complaint about our privacy practices and how your complaint will be handled.
For more information read the Department of Industry, Science and Resources privacy policy. To find out more about how we manage personal information, please email our Privacy Team at privacy@industry.gov.au.
Read our full Privacy Collection Statement.
Third-party privacy policies
We use some online services and information provided by third parties.
Salesforce
We use Salesforce, a cloud-based customer relationship management platform that helps Questacon manage its ticketing, retail, memberships, stakeholder and outreach functions.
All personal information collected by Salesforce is protected by the Privacy Act. Any personal information and data collected is stored on servers within Australia only. Salesforce is certified under the Privacy Recognition for Processors (PRP) Framework, provisioned from the Asia-Pacific Economic Cooperation (APEC). Please visit Salesforce’s website to find out more about their Privacy Policy and compliance measures. If you do not wish to have your personal information collected or stored by Salesforce, or wish to update your information, please contact info@questacon.edu.au.
Salesforce Marketing Cloud
Please note, this statement only relates to email communications.
To provide Questacon audiences with news or updates we use Marketing Cloud, a cloud-based email marketing app on Salesforce.
All personal information collected by Marketing Cloud is protected by the Privacy Act. All of your personal information and subscriber data is stored on servers within Australia only. In providing this service, Marketing Cloud may store personal information such as email addresses that Questacon has permission to collect.
Marketing Cloud will use this information for the purpose of sending emails and managing customer communications. Marketing Cloud will also use this information to measure the email campaign’s performance and to improve the features for specific segments of customers, evaluate your use of our emails, compiling reports on website activity for website operators and providing other services relating to website activity and engagement. Marketing Cloud may transfer this information to third parties where required to do so by law. Marketing Cloud uses cookies and web beacons to collect information about when you visit the website, when you use the services, your browser type and version, your operating system, and other similar information.
You can opt out of any Questacon email subscription if you click the ‘unsubscribe’ or ‘manage my preferences’ link provided in every marketing email or by contacting Questacon at info@questacon.edu.au. You can also disable or refuse cookies however you may not be able to use the services provided by Salesforce if cookies are disabled. Should you wish to contact Salesforce, you can find contact details on their contact page.
Adyen Australia
We use Adyen to process card payments in-centre at Questacon and online to manage payments for tickets and memberships. Please visit Adyen’s website to find out more about their privacy policy.
Adyen may collect, store, retrieve or access Financial Transaction Data for the purposes of providing the Financial Services, complying with Scheme Rules and/or Acquirer requirements, monitoring fraud, and complying with any applicable laws.
Financial Transaction Data means card-alias, Payment Account Reference (PAR), issuer country code, funding source, card type, expiry date, cardholder name, and token type.
Any data used for fraud monitoring will be processed within Australia.
eWay
We use eWay to process card payments for items purchased from the online Questacon Shop. eWay will use or disclose your personal information for the following purposes only:
- Establish an Eway account and a merchant account at a financial institution
- Manage an existing payment gateway and merchant relationship
- Engage in direct marketing to you (in any medium)
- Testimonials and client/partner listings on our website and within marketing materials; and
- Inform third parties other than financial institutions who provide us services.
All personal information collected by eWay is protected by the Privacy Act.
Please visit the eWay website to find out more about their privacy policy.
Shopify
We use the Shopify platform to facilitate our online gift shop. Through the Shopify platform, Questacon may request the necessary personal information to sell and ship a product; including name, email, address. Analytics for how our users interact and navigate our online shop are also collected through the Shopify platform.
Shopify does not have dedicated data centres in Australia for Australian user data, so Shopify may transfer data outside Australia. You can find out more information about Shopify’s privacy policy on the Shopify website.
Google Analytics
We use Google Analytics, a web analytics service provided by Google LLC (Google), to help improve the efficiency and usability of this website.
Google Analytics uses first-party cookies and JavaScript code to gather statistics about how the website is accessed. It anonymously tracks how you interact with this website, including where you came from and what you did on the site. This information (including your IP address) is transmitted to and stored by Google on servers located outside Australia. Google is based in the United States of America (USA). To contact Google, see Google’s contact us page.
Google uses this information to evaluate your use of our website, compile reports on website activity, and provide other website and internet usage services. Google may transfer this information to third parties where required to do so by law, or where they process information on Google’s behalf.
By using this website, you consent to the processing of data about you by Google in the manner described in Google’s privacy policy and for the purposes set out above. Relevant legislation of the USA will apply. You can opt out of Google Analytics if you disable or refuse the cookie, disable JavaScript, or use the opt-out service provided by Google.
Hotjar
We use Hotjar to better understand how users experience our site with the aim of delivering content, services and a user experience that meets users' needs.
Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. Data collected includes
- device IP address - captured and stored only in anonymised form
- device screen size, device type - unique device identifiers
- browser information
- geographic location - country only, and
- preferred language used to display our website.
Neither Hotjar nor Questacon will use this information to identify individual users or to match it with further data on an individual user. This information (including your IP address) is transmitted to and stored by Hotjar on servers located outside Australia. Hotjar is based in the European Union.
Hotjar is a technology service that helps us better understand our users’ behaviour while visiting our website (for example, how much time they spend on which pages, which links they choose to click, what users do and don’t like). This information enables us to utilise user feedback to develop, improve and maintain our website offering. Hotjar may transfer this information to third parties where required to do so by law, for services such as accounting or auditing, or where they process information on Hotjar’s behalf.
By using this website, you consent to the processing of data about you by Hotjar in the manner described in Hotjar’s privacy policy and for the purposes set out above. Relevant legislation of the European Union will apply. You can opt out of the creation of a user profile, Hotjar’s storing of data about your usage of our website and Hotjar’s use of tracking cookies on other websites by visiting their opt-out link.
Links to other websites
This website links to other websites. We are not responsible for the content or the privacy practices of other websites. We encourage you to examine each website’s privacy policy.
Accessing and correcting personal information
You may request access to any personal information we hold about you at any time by contacting us on the details below.
Where we hold information that you are entitled to access, we will provide you with suitable means of accessing it (e.g. by mailing or emailing it to you). If you require access in a particular form, please indicate this in your request. Please note that under the Privacy Act, access may be refused in certain circumstances where the department is required or authorised to do so under the Freedom of Information Act 1982(external link) (Cth), or another Commonwealth Act that provides for access to documents or information.
If you believe that personal information we hold about you is incorrect, incomplete or inaccurate, then you may request to have it amended. We will consider whether the information requires amendment, and will take reasonable steps to correct or update your information where appropriate.
We will not charge you for giving access or making corrections to your personal information. We may need to ask you to verify your identity before we provide access to your information or correct it.
In circumstances where it is not appropriate to grant you access or amend your personal information, we will give you written notice of the reasons for our decision within 30 days of receipt of your request, together with information about mechanisms available to seek review if you do not agree with the decision.
Policy governance
This privacy policy has been updated on 14th August 2025 and has been effective from publication on 14th August 2025.
If you have any questions about this privacy policy, any concerns or a complaint regarding the treatment of your privacy or a possible breach of your privacy, contact us via our website.
Requests and complaints will be treated confidentially. Our representative will contact you within a reasonable time after receipt of your complaint to discuss your concerns and outline options regarding how they may be resolved. We will aim to ensure that your complaint is resolved in a timely and appropriate manner.
Changes to our privacy policy
We may change this privacy policy from time to time. Any updated versions of this privacy policy will be posted on our website.
